Index: trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.cpp
===================================================================
--- trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.cpp	(revision 71625)
+++ trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.cpp	(revision 71626)
@@ -233,5 +233,5 @@
     char *buf = (char*)malloc(VBOXVHWACMD_SIZE_FROMBODYSIZE(size));
     memset(buf, 0, size);
-    VBOXVHWACMD * pCmd = (VBOXVHWACMD*)buf;
+    VBOXVHWACMD *pCmd = (VBOXVHWACMD *)buf;
     pCmd->enmCmd = type;
     pCmd->Flags = VBOXVHWACMD_FLAG_HH_CMD;
@@ -3195,5 +3195,5 @@
     char *buf = (char*)malloc(VBOXVHWACMD_SIZE(VBOXVHWACMD_SURF_CREATE));
     memset(buf, 0, sizeof(VBOXVHWACMD_SIZE(VBOXVHWACMD_SURF_CREATE)));
-    VBOXVHWACMD * pCmd = (VBOXVHWACMD*)buf;
+    VBOXVHWACMD *pCmd = (VBOXVHWACMD *)buf;
     pCmd->enmCmd = VBOXVHWACMD_TYPE_SURF_CREATE;
     pCmd->Flags = VBOXVHWACMD_FLAG_HH_CMD;
@@ -3347,5 +3347,5 @@
 }
 
-int VBoxVHWAImage::vhwaLoadOverlayData(VHWACommandList * pCmdList, struct SSMHANDLE * pSSM, uint32_t u32Version)
+int VBoxVHWAImage::vhwaLoadOverlayData(VHWACommandList *pCmdList, struct SSMHANDLE *pSSM, uint32_t u32Version)
 {
     Q_UNUSED(u32Version);
@@ -3510,5 +3510,5 @@
     {
         memset(buf, 0, sizeof(VBOXVHWACMD));
-        VBOXVHWACMD * pCmd = (VBOXVHWACMD*)buf;
+        VBOXVHWACMD *pCmd = (VBOXVHWACMD *)buf;
         pCmd->enmCmd = VBOXVHWACMD_TYPE_ENABLE;
         pCmd->Flags = VBOXVHWACMD_FLAG_HH_CMD;
@@ -4296,5 +4296,5 @@
 }
 
-int VBoxQGLOverlay::onVHWACommand(struct VBOXVHWACMD * pCmd)
+int VBoxQGLOverlay::onVHWACommand(struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *pCmd)
 {
     Log(("VHWA Command >>> %#p, %d\n", pCmd, pCmd->enmCmd));
@@ -4400,5 +4400,5 @@
     pCmd->Flags |= VBOXVHWACMD_FLAG_HG_ASYNCH;
 
-    mCmdPipe.postCmd(VBOXVHWA_PIPECMD_VHWA, pCmd);
+    mCmdPipe.postCmd(VBOXVHWA_PIPECMD_VHWA, (void *)pCmd);
     return VINF_CALLBACK_RETURN;
 
@@ -4527,5 +4527,5 @@
 }
 
-void VBoxQGLOverlay::vboxDoVHWACmd(void *cmd)
+void VBoxQGLOverlay::vboxDoVHWACmd(void RT_UNTRUSTED_VOLATILE_GUEST *cmd)
 {
     vboxDoVHWACmdExec(cmd);
@@ -4688,12 +4688,14 @@
 }
 
-void VBoxQGLOverlay::vboxDoVHWACmdExec(void *cmd)
-{
-    struct VBOXVHWACMD * pCmd = (struct VBOXVHWACMD *)cmd;
-    switch(pCmd->enmCmd)
+void VBoxQGLOverlay::vboxDoVHWACmdExec(void RT_UNTRUSTED_VOLATILE_GUEST *cmd)
+{
+    struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *pCmd = (struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *)cmd;
+    VBOXVHWACMD_TYPE enmCmd = pCmd->enmCmd;
+    RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
+    switch (enmCmd)
     {
         case VBOXVHWACMD_TYPE_SURF_CANCREATE:
         {
-            VBOXVHWACMD_SURF_CANCREATE RT_UNTRUSTED_VOLATILE_GUEST  *pBody = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_SURF_CANCREATE);
+            VBOXVHWACMD_SURF_CANCREATE RT_UNTRUSTED_VOLATILE_GUEST *pBody = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_SURF_CANCREATE);
             Assert(!mGlOn == !mOverlayImage.hasSurfaces());
             initGl();
@@ -5043,5 +5045,5 @@
 }
 
-void VBoxVHWACommandElementProcessor::postCmd(VBOXVHWA_PIPECMD_TYPE aType, void * pvData)
+void VBoxVHWACommandElementProcessor::postCmd(VBOXVHWA_PIPECMD_TYPE aType, void *pvData)
 {
     QObject *pNotifyObject = NULL;
@@ -5239,8 +5241,8 @@
         case VBOXVHWA_PIPECMD_VHWA:
             {
-                struct VBOXVHWACMD * pCmd = pCur->vhwaCmd();
+                struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *pCmd = pCur->vhwaCmd();
                 pCmd->rc = VERR_INVALID_STATE;
                 Log(("VHWA Command <<< Async RESET %#p, %d\n", pCmd, pCmd->enmCmd));
-                pDisplay->CompleteVHWACommand((BYTE*)pCmd);
+                pDisplay->CompleteVHWACommand((BYTE *)pCmd);
             }
             break;
Index: trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.h
===================================================================
--- trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.h	(revision 71625)
+++ trunk/src/VBox/Frontends/VirtualBox/src/VBoxFBOverlay.h	(revision 71626)
@@ -1220,5 +1220,5 @@
 {
 public:
-    void setVHWACmd(struct VBOXVHWACMD * pCmd)
+    void setVHWACmd(struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *pCmd)
     {
         mType = VBOXVHWA_PIPECMD_VHWA;
@@ -1238,5 +1238,5 @@
     }
 
-    void setData(VBOXVHWA_PIPECMD_TYPE aType, void * pvData)
+    void setData(VBOXVHWA_PIPECMD_TYPE aType, void *pvData)
     {
         switch(aType)
@@ -1259,5 +1259,5 @@
     VBOXVHWA_PIPECMD_TYPE type() const {return mType;}
     const QRect & rect() const {return mRect;}
-    struct VBOXVHWACMD * vhwaCmd() const {return u.mpCmd;}
+    struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *vhwaCmd() const {return u.mpCmd;}
     const VBOXVHWAFUNCCALLBACKINFO & func() const {return u.mFuncCallback; }
 
@@ -1267,5 +1267,5 @@
     union
     {
-        struct VBOXVHWACMD * mpCmd;
+        struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *mpCmd;
         VBOXVHWAFUNCCALLBACKINFO mFuncCallback;
     }u;
@@ -1321,5 +1321,5 @@
     void init(QObject *pNotifyObject);
     ~VBoxVHWACommandElementProcessor();
-    void postCmd(VBOXVHWA_PIPECMD_TYPE aType, void * pvData);
+    void postCmd(VBOXVHWA_PIPECMD_TYPE aType, void *pvData);
     VBoxVHWACommandElement *getCmd();
     void doneCmd();
@@ -1709,5 +1709,5 @@
     void updateAttachment(QWidget *pViewport, QObject *pPostEventObject);
 
-    int onVHWACommand (struct VBOXVHWACMD * pCommand);
+    int onVHWACommand (struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *pCommand);
 
     void onVHWACommandEvent (QEvent * pEvent);
@@ -1799,8 +1799,8 @@
     bool vboxGetGlOn() { return mGlOn; }
     bool vboxSynchGl();
-    void vboxDoVHWACmdExec(void *cmd);
+    void vboxDoVHWACmdExec(void RT_UNTRUSTED_VOLATILE_GUEST *cmd);
     void vboxShowOverlay (bool show);
     void vboxDoCheckUpdateViewport();
-    void vboxDoVHWACmd (void *cmd);
+    void vboxDoVHWACmd (void RT_UNTRUSTED_VOLATILE_GUEST *cmd);
     void addMainDirtyRect (const QRect & aRect);
     void vboxCheckUpdateOverlay (const QRect & rect);
Index: trunk/src/VBox/Frontends/VirtualBox/src/runtime/UIFrameBuffer.cpp
===================================================================
--- trunk/src/VBox/Frontends/VirtualBox/src/runtime/UIFrameBuffer.cpp	(revision 71625)
+++ trunk/src/VBox/Frontends/VirtualBox/src/runtime/UIFrameBuffer.cpp	(revision 71626)
@@ -433,5 +433,5 @@
             return E_ACCESSDENIED;
         }
-        rc = mOverlay.onVHWACommand ((struct VBOXVHWACMD*)pCommand);
+        rc = mOverlay.onVHWACommand((struct VBOXVHWACMD RT_UNTRUSTED_VOLATILE_GUEST *)pCommand);
         UIFrameBufferPrivate::unlock();
         if (rc == VINF_CALLBACK_RETURN)
